CVE-2026-60863 in Advanced Pricing
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Pricing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within Oracle Advanced Pricing, a critical component of the Oracle E-Business Suite that handles complex pricing calculations and configurations for enterprise environments. The affected version range spanning 12.2.3 through 12.2.15 represents a significant portion of the Oracle E-Business Suite releases where this security flaw has been identified. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise to leverage this weakness, making it particularly dangerous for organizations running these specific versions.
The technical nature of this vulnerability stems from insufficient input validation within the Pricing Installation component, which allows malicious actors to manipulate HTTP requests and potentially execute unauthorized operations against the Oracle Advanced Pricing system. This flaw operates at the application layer where network-based attacks can be initiated through standard web protocols without requiring specialized tools or deep system knowledge. The low privilege requirement for exploitation means that even users with minimal administrative rights could potentially compromise the entire pricing infrastructure, which forms a core component of enterprise financial operations and customer billing systems.
The operational impact of this vulnerability is severe as successful exploitation could result in complete takeover of the Oracle Advanced Pricing functionality, potentially leading to unauthorized price modifications, data manipulation, and disruption of critical business processes. The CVSS base score of 8.8 reflects the high severity across all three pillars of information security confidentiality integrity and availability. Attackers could leverage this vulnerability to alter pricing configurations that directly affect revenue streams, customer billing accuracy, and financial reporting integrity. Organizations utilizing these vulnerable versions face significant risk of financial loss, regulatory compliance violations, and operational disruption due to compromised pricing data and system availability.
Security professionals should prioritize immediate patching of affected systems using Oracle's official security updates and advisories specifically addressing this vulnerability. Network segmentation and access controls should be implemented to limit exposure of the affected components to untrusted networks while maintaining proper authentication mechanisms for legitimate administrative access. The vulnerability aligns with CWE-20, which identifies improper input validation as a fundamental weakness in software applications, and maps to ATT&CK technique T1190 for exploiting vulnerabilities in externally exposed systems. Organizations should also conduct comprehensive security assessments of their Oracle E-Business Suite environments to identify any additional unpatched components that may present similar attack vectors, ensuring layered defense strategies are implemented across all critical business applications and infrastructure components.